a2ui-project a2ui Update Components basic_functions.ts updateComponents resource consumption

published 2026-09-16 last mo. modified 2026-09-28 last mo. also EUVD-2026-80393

cvss: 4.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits: 0; none known

A vulnerability was determined in a2ui-project a2ui 0.9/0.9.1. This issue affects the function updateComponents of the file basic_functions.ts of the component Update Components. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

Is CVE-2026-92356 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: last mo. (2026-09-16)

Exploit prediction

0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R
CNA	3.0	4.3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R
CNA	2.0	4.0	AV:N/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:ND/RC:UR
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CNA	2.0	4.0	AV:N/AC:L/Au:S/C:N/I:N/A:P

Affected products

a2ui-project a2ui

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption
CWE-404 Improper Resource Shutdown or Release

References

vuldb.com /vuln/405443
vdb-entry, technical-description
vuldb.com /vuln/405443/cti
signature, permissions-required
vuldb.com /cve/CVE-2026-92356
third-party-advisory
vuldb.com /submit/934117
third-party-advisory
github.com /a2ui-project/a2ui/issues/2298
issue-tracking
github.com /a2ui-project/a2ui/
product

Sources

CVE List CVE-2026-92356
NVD CVE-2026-92356

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.